Ruby 3.1 and 3.2 fails to detect FIPS mode in UBI 9
In UBI 8, the macro OPENSSL_FIPS
was defined in the file /usr/include/openssl/opensslconf-x86_64.h
, which was then detected by Ruby while building and FIPS mode was properly detected. However, RedHat dropped that file in UBI 9, especially since it shipped with OpenSSL 3. This resulted in Ruby failing to properly detect FIPS mode.
Given that both Debian Bookworm and UBI 9 uses OpenSSL 3, the easiest solution here is to include the patch we are including in omnibus-gitlab
in gitlab-org/omnibus-gitlab!7906 (merged) here also. In Debian builds, it will essentially be no-op, and will be used in UBI/FIPS builds. The patch will avoid the need of defining the macro altogether.